Security

How Jamdesk protects your documentation and account data.

Infrastructure Security

Hosting

Jamdesk runs on SOC 2-compliant cloud providers. Builds, application data, and compiled documentation each live in managed, hardened services from those providers, and traffic is served through a global CDN with built-in DDoS protection.

Encryption

Access Controls

Sign-in

You can sign in to the dashboard with email and password or with single sign-on through Google or GitHub. Passwords are never stored in plaintext; our authentication provider keeps only one-way hashes.

If you sign in with Google or GitHub, any MFA you have configured on that account (TOTP, security keys, passkeys) applies to your Jamdesk sign-in as well. For the strongest protection, we recommend enabling MFA on your Google or GitHub account and using SSO.

Team Access

Role-based access (Owner, Admin, Member) is enforced both in our database security rules and on every backend call. Sessions expire automatically after periods of inactivity, and changes to billing, members, custom domains, or API keys are written to a per-project audit log.

GitHub Integration

Jamdesk connects to your repositories through a GitHub App with the minimum permissions it needs:

• Read-only access to repository contents
• Webhook delivery for build triggers
• No write access to your code

We never push, branch, or modify your repository. You can revoke Jamdesk's access at any time from your GitHub Applications settings.

Tokens and Secrets

Every secret you trust us with is encrypted at rest. That includes:

• GitHub App connections, where we keep only your numeric installation ID. Short-lived installation tokens (valid for one hour) are minted on demand and never persisted.
• GitHub OAuth tokens used during the starter-repo flow, which are exchanged once, used to clone the template, then discarded.
• Third-party integration credentials such as Slack incoming-webhook URLs, custom-domain verification tokens, and analytics API keys.

The dashboard never returns these values to the browser after they're saved; only the server-side build pipeline can read them.

Programmatic API keys are stored as one-way hashes. The plaintext is shown to you exactly once at creation time. If you lose it, rotate the key.

Data Handling

What We Store

• Your docs.json configuration and any uploaded branding assets
• Compiled documentation (HTML, CSS, JS)
• Build logs, retained for 30 days
• Anonymized analytics events (page views, country, device family)
• Encrypted secrets for any third-party integration you have configured

What We Don't Store

• Your source code. We clone the repository at build time and discard the working tree when the build container is destroyed.
• Long-lived GitHub credentials. See Tokens and Secrets above.
• User passwords in any reversible form.
• Payment card numbers. Stripe handles all card data; we keep only the customer ID and subscription metadata.

Internal Access

Production data access is limited to a small number of employees who need it to operate the service or respond to support requests. Access is logged.

Build Isolation

Each documentation build runs in a dedicated container:

• No access to other customers' data
• Fresh environment for every build, with secrets injected just-in-time
• Container is destroyed after the build completes or fails

Compliance

GDPR

Jamdesk complies with GDPR requirements:

• Data Processing Agreement available on request from privacy@jamdesk.com
• A public list of subprocessors at jamdesk.com/subprocessors
• Right to deletion honored within 30 days
• Data portability supported via export

Privacy

Our built-in analytics:

• Don't use cookies
• Don't track individuals
• Respect Do Not Track headers

See our Privacy Policy for details.

Incident Response

If a security incident affects your account or data, we do three things:

1. Investigate and contain the issue.
2. Notify affected customers within 72 hours, in line with our GDPR obligations.
3. Provide a written post-incident report once the cause is confirmed.

Reporting Vulnerabilities

Found a security issue? Report it responsibly:

• Email security@jamdesk.com
• Include a description, steps to reproduce, and an impact assessment
• We'll acknowledge within 48 hours

We don't currently run a paid bug bounty program, but we're happy to credit researchers who report in good faith.

Questions?

Related Articles